Monday, January 20, 2020

ID token vs Access Token

Access token is issued from Authorization server. Authorization Server issues an access token to a client to access a resource. Access token is verified by resource server which is provided by Authorization server. Access token is very opaque to client.

ID token is issued from Authorization server. Authorization Server issues an ID token to a client. Client who is one will validate this ID token by validating it's signature.

Access token can't tell anything about the user. On the other hand, ID token includes identity information about the user. You can identify and authenticate the user who is looking at the ID token. It includes the claim about the user like firstname, last name and email. Client can interpret the ID token and find who the user is.
Another blog data: Understanding ID token